Scammers Exploit Trusted Platforms with Fake Listings for Tech Support Scams

Cybercriminals are increasingly exploiting the trust users place in well-known online platforms by creating fake listings that impersonate reputable security brands. A recent discovery on BuzzFeed featured a listing posing as Malwarebytes Support, aiming to direct unsuspecting users to a tech support scam. This tactic relies on social engineering to convince victims to grant remote access to their devices, potentially leading to significant financial loss or data compromise.

The effectiveness of this scam stems from its deceptive simplicity. By using familiar platform designs, domain names, and even official-looking security brand logos, scammers borrow the inherent credibility of the hosting site. Users, often conditioned to be wary of unfamiliar websites, may lower their guard when encountering seemingly legitimate content within a trusted environment like a marketplace, social media feed, or news aggregator. The phone number associated with the fake Malwarebytes listing has also been linked to similar scams impersonating McAfee and Norton, indicating a coordinated effort by threat actors.

Platforms that facilitate easy content creation, such as social media sites and online marketplaces, are prime targets for these scams. Their design encourages users to post listings for products, services, or information, a feature that scammers readily abuse. Research indicates a significant portion of users encounter scams on these platforms weekly, highlighting the pervasive nature of this threat. The scammers' goal is not necessarily to sell a product but to initiate contact, often through a provided phone number or link, to begin the fraudulent interaction.

These fake listings can advertise a variety of deceptive offers, including antimalware software, "lifetime" security subscriptions, device repair services, or account recovery assistance. Often, these listings will include a "support" phone number or an external link, which is the true gateway to the scam. Once a victim calls the number or visits the linked site, they are subjected to further social engineering, potentially being pressured to install remote access software, provide payment details, or divulge sensitive personal information.

While major platforms employ automated detection, moderation teams, and brand protection programs to combat fraudulent content, the sheer volume of legitimate user-generated content makes complete eradication challenging. Scammers are adept at rapidly changing their tactics, accounts, and contact information, often evading detection systems. This necessitates a proactive approach from users, who must remain vigilant even when browsing familiar online spaces.

To stay safe, users should exercise caution with listings offering security software or technical support at suspiciously low prices. Any unexpected phone numbers appearing in ads, listings, or pop-ups should be treated with skepticism, especially if they are out of context, such as appearing in a "Quizzes" section. It is crucial to verify seller histories, reviews, and contact details, while being wary of any pressure to move communication off-platform.

Users should never grant remote access to their computers to unsolicited "support agents" and should avoid payment methods like gift cards, cryptocurrency, or wire transfers, which offer little recourse. The most effective defense is to always access company websites and support channels directly through official, known-safe URLs or applications, rather than relying on links or numbers found in potentially compromised listings. Reporting suspicious content to both the hosting platform and the impersonated brand is also a vital step in combating these evolving threats.

In essence, the core of this scam lies in "borrowed credibility." Scammers leverage the trust built by legitimate platforms and brands to ensnare victims. By understanding this dynamic and employing cautious browsing habits, users can significantly reduce their risk of falling prey to these sophisticated, yet fundamentally deceptive, online schemes.